Enterprise search systems allow content stored within an organization to be indexed, searched, and displayed to authorized users within the organization. In order to provide this functionality, enterprise search engines typically must index and query against structured and unstructured data and documents stored by multiple, independent, third-party enterprise software applications and systems. For instance, in many cases an enterprise search system must index and query against data stored in intranets, document and content management systems, file servers, corporate desktops, business applications such as customer relationship management and business intelligence applications, and other types of content stores.
In contrast to public search engines that search publicly available data and allow virtually any user to execute queries on the data, such as World Wide Web (“Web”) search engines, enterprise search systems generally index data for which access may be limited. For instance, a document indexed by an enterprise search system may have an associated access control list (“ACL”) that includes one or more access control entries (“ACEs”) that identify the access rights a user has to the document. As a result, when an enterprise search system executes a query, it must ensure that the user executing the query has sufficient access rights to view each of the search results returned in response to the query.
In order to determine whether a user has sufficient access rights to view search results, an enterprise search system may retrieve and store the access rights for each document at the time the document is added to the search index. At query time, the enterprise search system can utilize the previously stored access rights to determine if the user executing the query has sufficient rights to view the search results. Storage of access rights for all of the documents referenced by a search index, however, can be cumbersome and expensive to perform and maintain.
Alternatively, an enterprise search system may query the back-end system at which each document in a set of search results is stored for access rights to the documents for the user at the time the query is performed. In this type of implementation, the back-end system provides the document at crawl time and the access rights for the document at query time. Often, however, the security sub-systems of each back-end computer system utilize application programming interfaces (“APIs”) that are disparate, arcane, and possibly proprietary. As a result, it is generally necessary for custom program code, called security trimmers, to be utilized in order to invoke the different APIs provided by various back-end systems for obtaining the access rights. It can be difficult, however, for an enterprise search system to determine the security trimmer that should be utilized with respect to each document present in a set of search results.
It is with respect to these considerations and others that the disclosure made herein is provided.